Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Organization-scoped route is protected by JwtAuthGuard but lacks OrganizationValidateGuard, allowing authenticated cross-tenant access to organization resources.
Interpolating unescaped option values into <option> template strings and assigning to innerHTML can lead to Cross-Site Scripting (XSS). Use document.createElement('option') and assign textContent and value properties instead.
A URL is fetched after only verifying its prefix (e.g., startsWith('http')), without validating against internal or private IP addresses. This can allow Server-Side Request Forgery (SSRF) attacks against internal endpoints.
A buffer growth routine exponentially increases buffer capacity without checking against a maximum decoded size limit. This may allow decompression bombs or oversized stream inputs to exhaust system memory and cause a denial of service.
Checking resource parentage or identity by testing substring presence in a Pulumi URN (e.g. `urn.includes(...)`) is susceptible to spoofing. Parse and validate the URN structure explicitly.
IAM policy inspection only checks standalone 'aws:iam/policy:Policy' resources, ignoring inline policies (RolePolicy, UserPolicy, GroupPolicy) and policy attachments. This allows administrator or unsafe policy definitions to bypass security guardrails.
Falling back to plan.actions when token-based lookup from an internal store fails allows execution of unverified or forged actions. Ensure the token exists in the store and do not fall back to untrusted actions supplied in the plan object.
Directly accessing 'StringLike' or 'StringEquals' on an AWS IAM Condition object ignores set-qualified operators (e.g., 'ForAnyValue:StringLike') and modifier suffixes (e.g., 'StringLikeIfExists'). Iterate over condition entries and normalize the operator base name instead.
Naive URN prefix matching using split('$')[0] and startsWith can lead to policy validation bypasses due to crafted resource names. Parse URN type hierarchies structurally and enforce property-level value bindings.
Envelope size is concatenated directly into SMTP command arguments without numeric coercion, which may allow SMTP command injection via CRLF sequences.
Email header comment string is formatted into headers without stripping CRLF sequences, potentially allowing email header injection (CWE-93, CWE-113).
MimeNode is initialized with raw content without specifying disableFileAccess or disableUrlAccess security options. This can allow arbitrary file inclusion or SSRF (CVE-2026-82659) if untrusted input reaches the raw message option.
DOMPurify is configured with FORBID_TAGS but does not forbid 'iframe' tags or the 'srcdoc' attribute. DOMPurify does not parse or sanitize the content of the 'srcdoc' attribute, allowing arbitrary script execution via embedded iframe elements. Include 'iframe' in FORBID_TAGS and 'srcdoc' in FORBID_ATTR.
Envelope permission checks validate rejected and completed states but omit validation for the cancelled status, potentially allowing modification of cancelled envelopes.
The Express application hosting Model Context Protocol (MCP) transports calls `app.listen()` without specifying an explicit host or bind address. In Express, omitting the host defaults to binding on all network interfaces (`0.0.0.0`), exposing MCP tools to any reachable network client. Explicitly bind to a loopback address (e.g., `127.0.0.1`) or enforce inbo
The JWT verification algorithm is dynamically populated from the unverified token header (`alg`). This allows an attacker to forge tokens using algorithm confusion (e.g., supplying HS256 signed with an asymmetric public key). Always hardcode or whitelist allowed algorithms explicitly (e.g. `algorithms: ['RS256']`).
Calling `constructor.isBuffer(...)` without checking `typeof ... === 'function'` can throw an unhandled TypeError if an object with a non-callable `constructor.isBuffer` property is provided.
CORS is configured with `origin: true` (which reflects any request origin) together with `credentials: true`. This allows any untrusted domain to make authenticated cross-origin requests and access sensitive data. Use an explicit origin whitelist or origin validation function instead of reflecting the Origin header.
CORS is configured to unconditionally allow any origin while enabling credentials. Reflecting arbitrary request origins with 'credentials: true' allows attackers on third-party sites to execute credentialed cross-origin requests and access sensitive user data.
Defaulting the host binding address to '::' binds the server to all network interfaces, potentially exposing sensitive or unauthenticated endpoints to external network clients. Default to '127.0.0.1' or 'localhost' instead.
Dynamic command string constructed via template literals or string concatenation passed to `exec`, `execSync`, or promisified `exec`. This can lead to OS command injection (CWE-78). Use `execFile` or `execFileSync` with argument arrays instead.
Invoking the native 'zip' command without a '--' delimiter before dynamic file sources can lead to argument injection and command execution via crafted file names or options such as '-T' and '-TT'.
MCP server configuration containing stdio/command execution parameters is processed without verifying administrative privileges.
Group-level authorization check uses `.some()` against permitted resources instead of requiring full containment with `.every()`. This may grant access to all resources in a group if any single resource matches.
